• International Journal of Internet, Broadcasting and Communication
• /
• 제12권4호
• /
• pp.180-187
• /
• 2020

Security threats are increasing with interest due to the mass spread of smart devices, and vulnerabilities in developed applications are being exposed while mobile malicious codes are spreading. The government and companies provide various applications for the public, and for reliability and security of applications, security checks are required during application development. In this paper, among the security threats that can occur in the mobile service environment, we set up the vulnerability analysis items to respond to security threats when developing Android-based applications. Based on the set analysis items, vulnerability analysis was performed by examining three applications of public institutions and private companies currently operating as mobile applications. As a result of application security checks used by three public institutions and companies, authority management and open module stability management were well managed. However, it was confirmed that many security vulnerabilities were found in input value verification, outside transmit data management, and data management. It is believed that it will contribute to improving the safety of mobile applications through the case of vulnerability analysis for Android application security.

• 제어로봇시스템학회:학술대회논문집
• /
• 제어로봇시스템학회 2005년도 ICCAS
• /
• pp.1545-1549
• /
• 2005

According as computer is supplied in a lot of homes and offices and Internet use increases, various service based on the Internet. Including wireless PDA in the future, many devices such as Internet telephone, TV, refrigerator and oven will be connected on the Internet and Internet address exhaustion will be raised to serious problem gradually. Today, the IPv4 address exhaustion problem has been solved partially using NAT (Network Address Translation) however, the transition to next Generation Internet will be accelerated because of advantages such as mobility, security service, QoS, and abundant IP addresses. In IPv6, all hosts are designed to create and set their address automatically without manager's intervention using Neighbor Discovery Protocol. But, when an IPv6 host sets its address automatically, there are serious security vulnerabilities. In this paper, we analysis security vulnerabilities in auto-configuration and provide security requirements for secure auto-configuration.

• 한국전자거래학회지
• /
• 제4권2호
• /
• pp.59-79
• /
• 1999

In order to construct a successful electronic commerce system, three main essential factors must be satisfied to obtain the best effective outcomes. The three main essential factors are as follows : economic factor, effectiveness factor and convenient factor. In order to understand the role of these three factors, one must have some insight knowledge about security to assist him to implement these three factors in his construction of an electronic commerce system. This paper analyses a implementation mechanism of security systems based on the SET 1.0 standard for electronic commerce systems, thus providing an effective plan for the construction of a security system in the SET-based electronic commerce field. This paper helps to analyse the elements of security vulnerabilities in the SET 1.0 standard implementation and also helps to understand the SET 1.0 protocol.

• 정보학연구
• /
• 제6권4호
• /
• pp.35-58
• /
• 2003

본 연구에서는 NEIS(National Education Information System)의 시스템취약성에 관한 보완 방향을 분석하여 구체적인 보완의 방향(효율성, 분리성, 편의성, 다양성, 종합성, 보안성)을 제시하므로써 보안사고를 사전에 예방하고 발생가능한 문제점을 실시간으로 점검하도록하여 보다 나은 NEIS의 구축을 위한 병렬보안 취약성 진단 시스템을 구현하므로써 보안의 효율성을 높이는데 목적을 둔다.

• 인터넷정보학회논문지
• /
• 제12권5호
• /
• pp.39-46
• /
• 2011

보안 시스템에서 사용자 인증은 필수적이며 가장 중요한 절차 중의 하나이다. 대개의 사용자 인증은 키보드를 통한 문자기반의 패스워드를 이용하여 이루어지므로 키보드 정보의 보호는 무엇보다 중요하다[7][8]. 이러한 이유로 키보드 보호를 위한 소프트웨어들이 주요 사이트에 적용되어 있다. 본 논문은 현재 보편적으로 사용되고 있는 USB 키보드의 취약점을 소개하고 이를 이용하는 예제 코드를 구현하여 키보드 보안 소프트웨어가 실행되고 있는 상황에서의 키보드 데이터의 탈취 가능성을 진단한다. 또한 결과의 비교를 통하여 해당 취약점에 대응하기 위한 보안 대책을 제안한다.

• 한국컴퓨터정보학회논문지
• /
• 제20권12호
• /
• pp.61-66
• /
• 2015

In this paper, we draw a security assessment by analyzing possible vulnerabilities of the designated PC service which is supposed for strengthening security of current online identification methods that provide various areas such as the online banking and a game and so on. There is a difference between the designated PC service and online identification methods. Online identification methods authenticate an user by the user's private information or the user's knowledge-based information, though the designated PC service authenticates a hardware-based unique information of the user's PC. For this reason, high task significance services employ with online identification methods and the designated PC service for improving security multiply. Nevertheless, the security assessment of the designated PC service has been absent and possible vulnerabilities of the designated PC service are counterfeiter and falsification when the hardware-based unique-information is extracted on the user's PC and sent an authentication server. Therefore, in this paper, we analyze possible vulnerabilities of the designated PC service and draw the security assessment.

• 한국정보시스템학회지:정보시스템연구
• /
• 제14권3호
• /
• pp.23-30
• /
• 2005

Computer attacks on vulnerable software are ubiquitous. Today's attacks on client PCs can be used to create armies of zombie computers that are capable of wide reach attacks on high profile businesses and governments. The simple act of patching software vulnerabilities will certainly mitigate this problem, but patching has its own set of problems. Further, it is frequently the case that patches which are available to mitigate vulnerabilities are not being made on a timely basis and sometimes are not being made at all. One solution to the patch management dilemma is outsourcing. This paper notes that outsourcing is not a carte blanche decision that can be made based on dollars, but rather that a contingency decision matrix can provide guidance on outsourcing solutions for patch management and other security components as well. The matrix recognizes that IS staff expertise and employee security awareness are two important factors in the outsourcing decision.

• 융합보안논문지
• /
• 제7권4호
• /
• pp.35-41
• /
• 2007

디지털콘텐츠의 증가와 자산 가치의 상승에 따른 중요콘텐츠를 저장하고 관리할 수 있는 저장 장치시스템의 중요성이 극대화되고 있으며, 다양한 취약성을 극복할 수 있는 보다 안전한 저장 장치시스템이 요구되고 있다. 따라서 본 논문에서는 데이터가 오용, 남용, 변형, 유출, 그리고 손상될 수 있는 저장장치시스템의 다양한 취약성에 대하여 분석하고, 발생 가능한 취약성들을 해결할 수 있는 침입감내 및 복구 시스템에 대하여 연구한다.

• 한국정보처리학회:학술대회논문집
• /
• 한국정보처리학회 2014년도 추계학술발표대회
• /
• pp.464-465
• /
• 2014

Analysis of characteristics in software vulnerabilities can be used to assess security risks and to determine the resources needed to develop patches quickly to handle vulnerability discovered. Being a new research area, the quantitative aspects of software vulnerabilities and risk assessments have not been fully investigated. However, further detailed studies are required related to the security risk assessment, using rigorous analysis of actual data which can assist decision makers to maximize the returns on their security related efforts. In this paper, quantitative software vulnerability analysis has been presented for major Web browsers (Internet Explorer (IE), Firefox (FX), Chrome (CR) and Safari (SF)) with respect to the Common Vulnerability Scoring System (CVSS). The results show that, almost all the time, vulnerabilities are compromised from remote networks with no authentication required systems, and exploitation aftermath is getting worse.

• 융합보안논문지
• /
• 제18권3호
• /
• pp.11-17
• /
• 2018

가상현실 산업의 성장으로 인해 이용자 수가 급격히 증가하면서 가상현실환경에서 보안이 중요시 되고 있다. 가상현실 서비스를 안전하게 사용하기 위해서는 사용자가 보안취약점과 보안 위협의 심각성을 인지하고 보안 대책을 갖추어야 한다. 하지만 취약점 및 보안 위협에 대한 정보부족뿐만 아니라 사용자들의 보안 의식 또한 미흡하다. 이러한 점을 돌이켜 생각해 볼 때 가상현실환경에서 보안 가이드라인이 필요하다. 본 논문에서는 가상현실 서비스를 보다 안전하게 제공하기 위해 고려해야 할 보안 요구사항을 제시한다.